Minimum Information Security Requirements for Systems, Applications, and Data

Uniquely identify individual system users

Include responsible use notification and user acknowledgment at login

Grant the minimum, sufficient access or privileges

Separate duties related to granting of access

Require training and agreement prior to access

Employ role-based access controls

(Users) Access sensitive data only as necessary for job duties

(Users) Log out or lock unattended workstations

Revoke access upon termination of personnel appointments

Review accounts at least annually

Meet related regulatory and/or contractual obligations

Designate owners to manage privileged accounts

Designate owners to manage shared accounts

Encrypt authentication and authorization mechanisms

Manage passwords and password processing securely

Enable session lock after inactivity

Require two-factor authentication for system access

Establish training requirements for those having access to sensitive data

Address training participation in performance management processes

Maintain records of participation in required training

Identify mission critical systems

Develop, implement and test DR plans for critical systems

Review DR plans and subsequently update/test as necessary

Evaluate new systems prior to go-live

Incorporate a disaster risk assessment

Establish DR performance objectives

Align data backup procedures with DR objectives

Ensure DR plan availability

Identify primary responsibility for data backup

Ensure backups are encrypted

Ensure contracts with vendors include DR and data backup SLAs

Sanitize device/storage media before transfer

Ensure sanitization methods meet the Standard's requirements

Retain certificates of sanitization for 3 years

Remove licensed software from device/storage media before transfer

Use encryption that meets NIST FIPS minimum requirements

Encrypt data at rest in data centers

Encrypt data at rest in machine rooms

Encrypt data at rest on portable and removable storage media

Encrypt data at rest on laptops (UM-owned)

Encrypt data at rest on desktops (UM-owned)

Encrypt data at rest with cloud providers

Encrypt data at rest on personally owned devices; data classified as Restricted may not be stored on such devices.

Encrypt all CUI data at rest

Encrypt data backups outside U-M data centers

Encrypt data in transit within U-M campuses

Encrypt data in transit between U-M campuses

Encrypt data in transit outside U-M campuses

Implement an appropriate key management plan

Comply with applicable export/import laws and regulations

Categorize IT assets according to their sensitivity and criticality

Conduct risk assessments annually

Conduct risk assessments every four years

Conduct a risk assessment soon after a serious IT security incident

Conduct any risk assessments required by regulation or law

Use RECON or other approved tool(s) for any required risk assessments

Provide IA with results of unit-conducted risk assessments

Maintain risk assessment data as confidential, classified as High

Develop post-assessment plans to reduce risks to acceptable levels

Implement the appropriate risk-reducing controls

Authorize acceptance of unmitigated risks

Assist IA with tracking Risk Treatment Plan progress

Implement default-deny, least-privilege policies on network firewalls

Isolate trusted networks containing sensitive data from non-trusted networks

Securely configure network infrastructure devices

Maintain accurate network documentation

Document network interconnects to non-UM parties

Protect devices not requiring exposure to the internet

Restrict vendor remote network access to the smallest segment feasible

Obtain authorization before extending any U-M networks

Encrypt wireless network traffic

Document and implement physical security procedures, train faculty and staff

Formalize procedures for granting access to U-M/unit data centers

Limit physical access to systems containing PHI

Restrict physical access to only those authorized

Maintain accurate lists of those authorized to access secure locations

Review authorization lists regularly

Implement appropriate access control mechanisms and logging

Place sensitive/critical equipment in access-controlled areas

Prohibit sharing of access credentials

Require that personnel identification be displayed within secured locations

Implement 24/7 video surveillance

Escort authorized vendors/visitors within secured locations

Log all vendor/visitor access to secured locations

Prohibit food and drink in secured locations

Document maintenance activities and maintain records for three years

Lock doors after business hours and when unattended

Install output devices where they cannot be accessed by unauthorized parties

Store unencrypted media containing sensitive data in secure locations

Develop and maintain disaster recovery and contingency plans

Place power equipment and cabling in safe locations

Install emergency power shutoff mechanisms in appropriate locations

Implement uninterruptible power supply (UPS)

Install and maintain fire detection and suppression

Install, maintain, and monitor temperature and humidity controls

Protect processing equipment from potential water leakage

Use Production, Staging, Test, and Development environments

Exclude sensitive data from Test and Dev, or obtain IA permission

Define security requirements early in the SDLC and evaluate compliance

Use the latest available external or third-party components

Avoid dynamic inclusion of software

Validate application input

Execute proper error handling

Authenticate users through central AuthN/AuthZ systems

Implement two-factor authentication

Control access based on roles and the principle of least privilege

Review individually-granted access annually

Provide for automated review of authorizations where possible

Encrypt external transmission of data

Implement application logs with important event data

Conduct code security reviews/audits for new or changed applications

Use effective quality assurance techniques prior to go-live

Remove obsolete or no longer supported or needed software

Implement and maintain a change management process

Enable logging for endpoints (workstations, desktops)

Enable logging for all other systems (non-endpoint)

Include essential events and elements in logs

Consult Sensitive Data Guide to ensure appropriate storage of log data

Restrict log access to authorized individuals

Protect log data from unauthorized changes and operational problems

Automate alerting on logging failures

Send local logs to IA SEIM, meeting minimum delay requirements

Retain log data for duration required by policy and law

Keep security logs immediately available for 90 days

Purge unneeded logs securely

Identify a single business need or application for each integration

Restrict the lifespan of integration credentials to one year or less

Use data only for the limited and specific purpose described in the request

Designate an owner and co-owner for each integration

Limit admin privileges to owners and to those they specifically authorize

Handle data received via API according to Information Security (SPG 601.27)

Require attestation to Institutional Data Access and Compliance Agreement

Control access based on authorization, least privilege, and limited duration

Leverage MCommunity for authentication of users

Ensure local data storage receives updates from authoritative data source

Terminate access or elevated privileges promptly upon role change

Adhere to incident reporting requirements for all facets of the integration

Adhere to U-M's Vendor Security and Compliance Assessment process

Continuously manage vendor security compliance

Conduct vulnerability scans at least monthly

Prioritize remediation/mitigation based on severity

Develop corrective action plans for identified vulnerabilities